Hi, I am using latest qmail-ldap (dec 2004) and will not rallback to Any previous release.
You're right, remember
"qmailGroup depends on qmailUser so we use the same
~contol/ldapobjectclass in qmail-group"
I propose and request an update where qmail-group would use
Different control file, for example:
~contol/ldapGROUPobjectclass
Ignore caps. Here I suppose this behaviour:
$ /var/qmail/bin/qmail-ldaplookup -m [EMAIL PROTECTED]
Would first try to lookup with filter based on
~contol/ldapobjectclass
i.e. looking for an user, and if this fails a new lookup will
be executed with Filter based on
~contol/ldapgroupobjectclass
i.e. looking for group.
Or so, I don't know internal qmail logic.
> -----Original Message-----
> From: Mike Dawson [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, February 01, 2005 4:57 PM
> To: Zdravko Stoychev
> Cc: [email protected]
> Subject: Re: User Groups stored in LDAP server?
>
> I'm using qmail-ldap from December 2003 - maybe this was
> before the filter for objectclass=user was added, or is it
> getting the filter from control/ldapobjectclass in your case?
>
> Mike
>
> Zdravko Stoychev wrote:
> > Hi!
> >
> >
> >>-----Original Message-----
> >>From: Mike Dawson [mailto:[EMAIL PROTECTED]
> >>Sent: Tuesday, February 01, 2005 3:39 PM
> >>To: Zdravko Stoychev
> >>Cc: [email protected]
> >>Subject: Re: User Groups stored in LDAP server?
> >>
> >>Yes, you just need to set the appropriate attribute names in
> >>qmail-ldap.h.
> >>
> >>Mike
> >
> >
> > Ok, I have set up in qmail-ldap.h:
> >
> > #define LDAP_GROUPOBJECTCLASS "group"
> >
> > That's the class used in AD (Active Directory). Still if I try to
> > lookup for
> > it:
> >
> > $ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED
> Searching ldap for:
> >
> (&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)
> > ))
> > under dn: cn=users, dc=mps, dc=local
> > No entries found.
> >
> > It fails because it actualy searches for "objectClass=user"! Why?
> >
> > I have found some info about this on the net from Claudio
> Jeker Posted
> > on Mon, 23 Feb 2004 09:09:32 -0800:
> >
> > "1. Yes. qmailUser is needed for qmailGroup, there seems to
> be a bug
> > in the schema because we should enforce that right there.
> > 2. your entry is missing the qmailUID and qmailGID values or the
> > corresponding ~control files, so qmail-lspawn is unsable to
> setup and
> > run qmail-local which would then call qmail-group.
> > 3. normaly it is the best to setup a "normal" user and
> extend it to a
> > group account.
> > 4. the question about ldapobjectclass posted before should
> now be obvious.
> > qmailGroup depends on qmailUser so we use the same
> > ~contol/ldapobjectclass in qmail-group. The special group login and
> > password control file are here to make it possible to use
> filter that
> > produce a large number of results and would therefor end in
> the ldap limit."
> >
> > If I do manual search for the group object in AD:
> >
> > $ /var/qmail/bin/qmail-ldaplookup -f
> > "(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))"
> > Searching ldap for:
> > (|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))
> > under dn: cn=users, dc=mps, dc=local
> > Found 1 entry:
> >
> > dn: CN=soft,CN=Users,DC=mps,DC=local
> > -------------------------------------------------------
> > objectClass: top
> > objectClass: group
> > mail: MAILPROTECTED
> > name: soft
> > accountStatus: undefined -> active
> > mailHost: undefined
> > homeDirectory: /home/vmail/
> > aliasEmpty: using default
> > qmailDotMode: dotonly
> > qmailUID: 510
> > qmailGID: 510
> > mailQuotaSize: 524288000
> > mailQuotaCount: 0 (unlimited)
> > mailSizeMax: 0 (unlimited)
> > mailReplyText: undefined
> >
> > It is found without any problems. Here "soft" is a Global Group
> > created in AD.
> >
> > If I lookup for an user, it works fine:
> >
> > $ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED
> Searching ldap for:
> >
> (&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)
> > ))
> > under dn: cn=users, dc=mps, dc=local
> > Found 1 entry:
> >
> > dn: CN=zdravko,CN=Users,DC=mps,DC=local
> > -------------------------------------------------------
> > objectClass: top
> > objectClass: person
> > objectClass: organizationalPerson
> > objectClass: user
> > mail: MAILPROTECTED
> > name: zdravko
> > accountStatus: undefined -> active
> > mailHost: undefined
> > homeDirectory: /home/vmail/
> > aliasEmpty: using default
> > qmailDotMode: dotonly
> > qmailUID: 510
> > qmailGID: 510
> > mailQuotaSize: 524288000
> > mailQuotaCount: 0 (unlimited)
> > mailSizeMax: 0 (unlimited)
> > mailReplyText: undefined
> >
> > User entry is found without any problems.
> >
> > I can conclude that Microsoft's AD 'group' object is not
> 'user' as it
> > seams to be required.
> >
> > As Claudio Jeker said
> >
> > "qmailGroup depends on qmailUser so we use the same
> > ~contol/ldapobjectclass in qmail-group".
> >
> > $ cat /var/qmail/control/ldapobjectclass
> > user
> >
> > So it seams to me that Qmail will always search for
> "&(objectClass=user)"
> > which
> > Will fail looking for Groups in AD.
> >
> > What should I do next?
> >
> >
> >>Zdravko Stoychev wrote:
> >>
> >>>Hi all!
> >>>
> >>>We're using MS 2003 Server's Active Directory to store
> >>
> >>Domain Users.
> >>
> >>>User authorization and user details retrieval is working just fine.
> >>>
> >>>Currently we're using FastForward and /etc/aliases.cdb to maintain
> >>>User Groups.
> >>>
> >>>Is it possible to store User Groups into LDAP (Active
> >>
> >>Directory) too
> >>
> >>>in order to maintain Group Members from MS 2003 Server directly?
> >>>
> >>>Best wishes!
> >>>---
> >>> Zdravko Stoychev
> >>> System Administrator
> >>> [EMAIL PROTECTED]
> >>> tel +359-2-9712324
> >>> Icq 11693613
> >>
>
smime.p7s
Description: S/MIME cryptographic signature
